BxPlaywright vs Notte

BxPlaywright 53

The snapshot build of 23 October 2026 is the latest published package, so 30 on time, though it isn't a release (30). No tagged releases or dated changelog entries in the 90 days, only one version rebuilt (0 of 20). 39 pull requests merged by Luis Majano between 30 September and 23 October. Issue replies couldn't be read and bugs go to Jira (10 of 25). Not in the official MCP registry, and the ForgeBox package has no stable version (5 of 15). Playwright for Java 1.63.0, Dependabot for Gradle monthly and Actions quarterly, a daily test run and a format check (8 of 10). 30+0+10+5+8 = 53.

Notte 83

Version 1.9.6 was tagged and published to PyPI and npm on 7 October 2026 (30). 18 tags between 10 July and 7 October 2026 (20). The repository had commits on 8 October and the vendor runs a Slack community, but GitHub refused our API request, so issue reply times are unread (10 of 25). Current official SDKs in Python and Node. The hosted MCP server was not found in the official MCP registry, so we scored the SDK line for an API (15). CI runs tests, nightly examples and documentation tests. The notte-mcp package on PyPI was last published on 13 July 2026 at 1.8.28 while the SDK moved to 1.9.6 (8).

BxPlaywright 60

Free, self-hosted, nothing to buy, so 20 + 20 + 20. The BoxLang runtime's paid plans aren't needed for this module. No payment protocol (0). 60 in all.

Notte 40

No x402, MPP or L402 on Notte's endpoints (0). Unit prices are published without login, $0.05 an hour for browser functions, $10 a GB for residential proxies, LLM tokens at the model's price, and browser sessions listed at $0 an hour (20). Free plan with $10 of credits and no card (20). A person has to sign up in the console to create a key or approve OAuth (0).

BxPlaywright 41

Read with the local-software lines and graded as a pre-release. Official package on ForgeBox with BoxLang 1.17.0 or later, Java 21 and the supported platforms stated, but the only version is 1.0.0-snapshot, rebuilt from the development branch on 23 October 2026, with no binary hash on the entry (14 of 20). tests.yml runs 24 test files on Ubuntu and Windows with JDK 21, real-browser tests on Linux and a test of the full distribution, on pull requests, pushes to development and daily. Whether runs pass wasn't read, since WebFetch refused GitHub (15 of 25). Issues weren't readable for the same reason, bugs go to Ortus's Jira, and the repository is a month old, so there's no record to read (5 of 25). Keep a Changelog with semantic versioning stated and a written public contract, but nothing has been released under it and the changelog reads only [Unreleased] (7 of 15). Ortus announced 1.0 as generally available on 13 October, but no 1.0.0 build or tag exists, so it isn't 1.0 for this line (0 of 15). 14+15+5+7+0 = 41.

Notte 58

Graded as a hosted API. status.notte.cc on Better Stack tracks six components with 90 days of daily history (20). In the 90 days to 8 October 2026 the core API read 100 per cent and the Session API 99.98 with two outages of about 15 minutes, but the Scrape API was down on 15 days for about 6 hours in total, including 61 minutes on 3 August and 51 on 30 August, and CAPTCHA solving read 88.93 per cent, so we score one major outage (10). Concurrency is published per plan and X-RateLimit headers are documented, but no request rate is stated per plan (8). The docs ask for exponential backoff on 429 and describe 529 for an overloaded cluster. The SDKs do not retry, and only the payment endpoint takes an idempotency key (10). SLAs are listed for Enterprise without published terms (0). The API is version 1.9.6 (10).

BxPlaywright 43

Library reading, as puppeteer and playwright-mcp were. No credential to leak and nothing to scope, so the middle band (20 of 30). Nothing is restricted by default. browser_visit takes any URL with no allow-list, browser_screenshot writes to any path the model passes, and the tools are added to bx-ai's global registry unless registerAiTools is false, so an agent given every registered tool gets a browser. Over MCP it starts Microsoft's server, which limits file access to workspace roots, and Ortus's plugin starts it with --headless but without --isolated, with browser_run_code_unsafe and browser_evaluate in the default set. HTTPS errors are not ignored by default (6 of 20). Page snapshots and text go to the model unfenced, and the docs give no prompt-injection guidance (0 of 15). Screenshot, trace and video policies, show-trace, and interception points such as onPageCreate and onPlaywrightArtifact give the operator a record, all off by default (10 of 15). CONTRIBUTING.md asks for reports to security@ortussolutions.com and the Slack #security channel; SECURITY.md points there. No security.txt (410, per the boxlang-ai check of the same day), no bounty, no advisories. Node.js downloads are checked against the release's SHA-256 list (7 of 20). 20+6+0+10+7 = 43.

Notte 56

A Bearer API key from the console, or OAuth on the MCP server with one scope, email. No key scopes or rotation guidance found (18). The browser MCP endpoint leaves out administration tools, three of its tools are read-only, and vaults keep stored credentials away from the model. No read-only key or confirmation step found (9). Pages are untrusted content. The only guidance found is one line in the Claude managed agents guide about limiting where a credential may be sent (4). Session replays, a network log endpoint and usage logs give a per-session trail (11). A valid security.txt, a disclosure policy with safe harbour and a three-business-day acknowledgement, and a SOC 2 Type 2 report on the trust centre. The security page says there is no paid bounty (14).

BxPlaywright 63

Library reading, scored on what a tool-calling agent gets. Ten compact in-process tools for BoxLang AI, with nothing to load until a tool is used (25 for ten or fewer), less 5 because every action tool returns the whole page's AI snapshot. Through MCP an agent gets Playwright's 24 default tools (20 of 25). The agent tools have no depth, selector or size limit, and browser_text returns the whole page. snapshot( selector ) exists in the library but not in the tools (8 of 20). Errors come back to the agent as text in the form Error [type]: message Fix: detail, and the error types are documented (16 of 20). Assertions retry until they pass. The in-process tools carry no read-only or destructive hints, and bx-ai doesn't read them; over MCP the annotations are Microsoft's (8 of 20). Works with defaults (headless Chromium, 1280 by 720) and profiles, but in one language, BoxLang, with the MCP route for any other client (11 of 15). 20+8+16+8+11 = 63.

Notte 75

The browser MCP endpoint has eight compact tools, and scrape accepts selectors and a structured output schema (22). List endpoints take page and page_size up to 100, and sessions filter by only_active (15). Errors are a message and detail with six documented statuses and an x-error-class header on execution failures (11). An idempotency-key header is required on session payments only, stopping a session is documented as safe to repeat, and the MCP docs mark three tools read-only and five as write. We could not list the tools to confirm the annotations (12). Session start has no required fields, and Python and Node SDKs and a CLI are official (15).

BxPlaywright 66

Library reading. BoxLang is dynamically typed. The public API is listed in the docs' integrations page, help() and bxplaywright help --json describe it at run time, and the ten agent tools describe each argument in a sentence, with no published API reference (14 of 25). llms.txt with a Markdown copy of each of 18 docs pages (10). The AI page says when to use aiTools(), the registry or MCP, and when to turn registration off. Tool descriptions are one line each (13 of 20). Every agent-tool argument is a string, with no enums or limits; library options are checked, and InvalidOption lists the valid values (9 of 15). An errors page lists each error type with when it happens and the fix, eight runnable examples sit in the repository, and the docs have code on every page (13 of 15). Keep a Changelog and docs versioning on release, but no released version and no tags yet (7 of 15). 14+10+13+9+13+7 = 66.

Notte 74

Graded on the REST API. OpenAPI 3.1.0 at api.notte.cc/openapi.json with 77 paths and 100 operations (25). llms.txt on the site and in the docs, a Markdown twin of every docs page and a keyless documentation MCP server (10). Every operation has a summary, 362 of 1,007 schema properties carry a description, and the guides explain each product (12). 196 schemas with 46 enums and ranges such as max_duration_minutes up to 1,440. chrome_args and extra_http_headers are free-form (11). The errors page shows the body format and six statuses, but 98 operations document only 422 as an error (8). The spec version matches the release tags. No dated API changelog page was found, so changes are visible only through GitHub tags and the Node SDK's CHANGELOG.md (8).